security: enforce write-access checks on proposals/releases/webhooks MCP and REST
- execute_merge_proposal: add actor param + _require_write_access guard (owner or write/admin collaborator) - execute_submit_proposal_review: early 403 if reviewer is empty string - execute_create_release: add _require_write_access guard after repo fetch - releases.py REST: add _guard_repo_owner helper; apply to create_release, attach_release_asset, delete_release_asset - webhooks.py REST: add _guard_repo_owner helper; apply to create_webhook, delete_webhook - dispatcher.py: pass actor= to execute_merge_proposal dispatch - test_mcp_write_tools.py: add TestProposalMergeAccessGuard (forbidden for non-owner + unauthenticated) - test_releases.py: add 3 REST 403 tests (non-owner create/attach-asset/delete-asset) - test_musehub_webhooks.py: add 2 REST 403 tests (non-owner create/delete webhook)
0 comments
muse hub commit comment sha256:f8e28b9c5c96be5a63290254406fa457e3b55662f1118e0feec1905a0cbcfdc9 --body "your comment"
No comments yet. Be the first to start the discussion.